Recommendation 4

Describing the breach as a systemic failure does not mean that responsibility lay nowhere. Institutional accountability requires clear lines of responsibility. Where a department takes on unfamiliar responsibilities involving life-endangering data, clear senior ownership of risk, assurance and data protection becomes more important. The evidence suggests that this ownership was inadequate before the breach; the injunction then made ordinary political accountability for the response largely impossible for nearly two years. By the time the facts could be scrutinised publicly, the ministers responsible for earlier decisions were no longer in office and the opportunity for ordinary contemporaneous ministerial accountability had passed. That combination—weak internal accountability before the breach and displaced democratic accountability after it—is central to why this episode became a wider governance failure. (Conclusion, Paragraph 61)